fix(deps): move to go-github v89 and gitlab client-go v2 #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI: build, vet, test, lint, and govulncheck on every push and pull request, so the repo | |
| # shows green checks + a live badge and satisfies OpenSSF Scorecard's CI-Tests check. Actions | |
| # are pinned to full commit SHAs (Scorecard: Pinned-Dependencies); Renovate keeps them current. | |
| name: ci | |
| on: | |
| push: | |
| branches: [main, 'ci/**'] # ci/** proves a workflow change green before it lands on main | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: # so a run can be kicked off without inventing a commit | |
| # Least privilege by default; the one job re-grants only read. | |
| permissions: {} | |
| jobs: | |
| build-test: | |
| name: build · vet · test · lint · vuln | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| # Deny egress by default. The runner is where a poisoned dependency or a compromised | |
| # action would try to reach its own infrastructure; if it is not on this list, it does | |
| # not resolve. Everything here is what the Go toolchain and the checks actually need. | |
| # storage.googleapis.com is not optional: proxy.golang.org hands out a signed redirect | |
| # there for the larger module zips, so a build only fails on the modules big enough to | |
| # take that path, and only when they miss the proxy's cache. | |
| - name: Harden the runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| proxy.golang.org:443 | |
| release-assets.githubusercontent.com:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| vuln.go.dev:443 | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: '1.26.5' | |
| check-latest: false | |
| - name: gofmt | |
| run: test -z "$(gofmt -l .)" || { echo 'gofmt needed on:'; gofmt -l .; exit 1; } | |
| - name: go vet | |
| run: go vet ./... | |
| - name: build | |
| run: go build -mod=readonly ./... | |
| - name: test | |
| run: go test -mod=readonly ./... | |
| - name: lint | |
| run: make lint | |
| - name: govulncheck | |
| run: make vuln |